1. Field of the Invention
The present invention generally relates to electronic circuits and, more specifically, to the protection of secret quantities manipulated by such circuits, in particular against attacks by measurements of an electromagnetic radiation.
An example of application of the present invention relates to smart cards.
2. Discussion of the Related Art
FIG. 1 very schematically shows a smart card 1 of the type to which the present invention applies, as an example. An integrated circuit chip 10 is inserted into plastic card 1 and is connected to electric contacts 3 for communication with a card reader (not shown). The card may also be provided with a contactless communication system (electromagnetic transponder).
FIG. 2 is a schematic block diagram illustrating components of an integrated circuit 10 of a smart card of FIG. 1. Circuit or chip 10 comprises a central processing unit 11 (CPU), one or several non-volatile storage elements 12 (NVM), and one or several volatile storage elements 13 (for example, of RAM or registers type). The different components of chip 10 communicate together and with an input/output device 14 (I/O) connected to contacts 3, over one or several data, address, and control buses 15. Most often, chip 10 comprises other functions 16 (FCT), for example, circuits performing cryptographic operations.
The present invention more specifically applies to electronic circuits manipulating quantities intended to remain secret, that is, which should not be accessible from the outside of the circuit at least for an unauthorized user. Cryptographic calculations are used for security functions such as authentications, electronic signatures, etc. Such calculations use secret keys that persons attempting to fraud try to discover.
Many methods are known to attempt discovering digital quantities manipulated by an electronic circuit, be it a processor such as illustrated in FIG. 2 or a circuit in wired logic, reprogrammble (FPGA) or not.
A first category of attacks comprises exploiting intentional malfunctions of the circuit. Such attacks known as DFA attacks (Differential Fault Analysis) interpret results provided by the electronic circuit after disturbances in its operation. Such disturbances may result from parasitic peaks on the circuit power supply (glitch attacks), from light rays, thermal shocks, etc.
A second category of attacks to which the present invention applies relates to so-called hidden-channel attacks which exploit information detectable from the outside of the circuit during cryptographic calculations without intervening on the circuit inputs/outputs. In this category, attacks exploiting the execution time (timing attacks), the direct analysis of the current consumed by the electronic circuit (SPA, simple power analysis), the differential analysis of the consumed current (DPA, differential power analysis), the analysis of the electromagnetic radiation emitted by the circuit (EMA, electromagnetic analysis), be it direct or differential (DEMA, differential electromagnetic analysis), are known.
FIG. 3 schematically illustrates an attack by electromagnetic analysis. An electronic circuit 10 communicates with a terminal 20 (TERM), for example, a smart card reader, be it with or without contact. In the case of a circuit 10 with no autonomous power supply, its power is provided thereto by terminal 20 and it is assumed that it executes cryptographic functions (for example, by means of block 16, FIG. 2). Electromagnetic attacks comprise bringing an antenna 35 of small dimension (having a sensor smaller than that of the circuit to be examined) close to electronic circuit 10 to detect an electromagnetic radiation. This radiation is exploited by a computer system, for example, a microcomputer 30 (PC). The electromagnetic radiation of an electronic circuit being locally different according to the operating elements, knowing the implemented algorithm (which is generally accessible by standards) enables interpreting the radiation to deduce the manipulated quantities therefrom. Unlike attacks by analysis of the consumption or of the execution time, attacks by measurement of the radiation avoid contact with the circuit. Further, the measurement is more local than a measurement of the integrated circuit consumption or of the execution time.
Known systems of countermeasure against attacks by time analysis or by analysis of the circuit power consumption are most often inefficient against electromagnetic attacks, precisely due to the capacity of such attacks to locate the measure.
Algorithms manipulating keys or quantities which are desired to be protected against possible hackings can be divided in two large categories.
A first category concerns public key algorithms such as the RSA, DSA, and EC-DSA algorithms. Such algorithms implement an exponentiation calculation (generally by a so-called square-and-multiply technique) or calculations on elliptic curves (applying an arbitrarily-called add-and-double technique). In all cases, the calculation is different according to the states of the bits of the secret quantity.
In the example of an exponentiation calculation using a square-and-multiply technique, the multiplication step is only performed for the exponent bits at state 1. Accordingly, an unprotected implementation of such a calculation can easily be hacked. It is enough for a hacker to monitor the execution of a step to directly determine the state of the key bit.
FIG. 4 schematically shows a timing diagram illustrating the execution of an exponentiation calculation by the square-and-multiply technique, implementing a protection against timing attacks and attacks by analysis of the electronic circuit consumption.
The input data are a message M to be ciphered and a ciphering key e, expressed in the form of a succession of bits em−1, . . . e0.
A first step (block 31, i=m−1;, R0=1) comprises initializing an index counter i to the number of bits minus 1, of quantity e and a result variable R0, for example, stored in a result register, to one.
The calculation is performed in a loop as long as there remains an exponent bit to be processed, starting, for example, from the most significant bit m and decrementing index i (block 32, i=i−1) as long as this index is not zero (test 33, i=0?). When index i is zero (output Y of test 33), the calculation is over and result variable R0 provides value Me. This exponentiation is generally modular.
For each iteration of the loop, it is started (block 34, R0=R0*R0) by squaring up the content of variable R0. Then (test 35 ei=1?), according to the state of the current bit of the exponent, the result of the multiplication of variable R0 by message M updates (block 36, R0=R0*M) this variable R0 itself (case of a current bit at state 1) or updates (block 37, R1=R0*M) a variable R1 useless for the final result (case of a current bit at state 0).
Multiplication operation 37, not needed for the result, is used not only to balance the algorithm execution time whatever the state of the bits of the secret quantity to be processed, but also to balance its consumption.
However, such an algorithm remains sensitive to electromagnetic attacks. Such attacks that bring information of location of the circuit operation enable determining which storage register is modified between two registers respectively assigned to values R0 and R1, thus revealing the value of the current bit of the exponent.
It could be devised to introduce a random quantity into the exponent to mask its value. Such a solution is not sufficient since an analysis of the radiation would enable discovering the scrambled value of the exponent. This value remains exploitable by a hacker if he knows the scrambling process.
A second category of cryptography algorithms relates to so-called secret-key algorithms, for example, the DES algorithm or the AES algorithm.
FIG. 5 schematically illustrates an iteration of a DES algorithm. The DES algorithm comprises several iterations of identical operations by using different sub-keys at each round, which are obtained from a secret key. For simplification, only one intermediary iteration is shown in FIG. 5.
The current data to be manipulated correspond, except for the first iteration, not shown, to the result of the preceding iteration. These data are divided into a left-hand Li−1, (block 41) and a right-hand Ri−1, (block 42) portion stored in registers of identical size and, at the end of the iteration, such registers respectively contain the left-hand Li, (block 41′) and right-hand Ri, (block 42′) portions. Quantity Li, is equal to quantity Ri−1. Quantity Ri, corresponds to the bit-to-bit addition (XOR combination) of quantity Li−1, to the result of transformations performed on quantity Ri−1. A first transformation 43 is an expansion E of quantity Ri−1, which provides a quantity E(Ri−1). This expansion is combined bit by bit by an XOR-type combination 45 with a sub-key Ki, generated for the current iteration. This sub-key depends, among others, on the previous sub-key Ki−1, (Ki=f(Ki−1)) and is provided by a sub-key generation function f taking into account the secret key to generate the first sub-key. Result Ki+E(Ri-1) of combination 45 is submitted to a value substitution function 46 (SB). Result SB(E(Ri−1))+Ki) of function 46 is submitted to a permutation 47 (P) and result P(SB(E(Ri−1))+Ki) of this permutation is combined by function 43 with left-hand portion Li−1.
FIG. 6 very schematically illustrates in the form of blocks an example of a substitution function 46 in the case of the DES algorithm. The input data (output of combination 45, FIG. 5) is cut in this example into eight words of 6, bits each IB1, to IB8. Eight tables 461 to 468 (SBOX1 to SBOX8) each substitute a 4-bit word to the 6-bit word that they receive. Each table takes as an input the 6-bit word as an index and returns the value present at this index in the table. In the DES example, each substitution table is formed of 64, elements of four bits each enabling provision of a 4-bit value for each of the 26, possible inputs. The results provided by substitution table 461 to 468 appear in the form of 8, words OB1, to OB8, of four bits each.
As in the case of public-key algorithms, the substitution tables provide values conditioned by the key. An electromagnetic analysis located on the substitution tables may enable going back up to the manipulated secret key by exploiting the registers activated during the substitution which depend on input data IB, and thus on the sub-key.
EP-A-1,548,687, discloses a method in which a register containing the result is selected among two registers involved in the computation. No displacement of value is provided.